Executive brief
libsixel is a library used to encode and decode SIXEL images, a format often used to display graphics in terminal emulators and command-line tools. A vulnerability in how the library handles large image dimensions allows a specially crafted image file to corrupt the computer's memory. If a user opens a malicious image or uses a tool like img2sixel on a hostile file, it could cause the application to crash or allow an attacker to gain unauthorized control over the system.
Technical details
A signed integer overflow exists in the SIXEL parser's image-buffer doubling loop within `sixel_decode_raw_impl`. The variable `context->pos_x` can be incremented by `repeat_count` without sufficient upper-bound checks, eventually approaching `INT_MAX`. When `pos_x + repeat_count` overflows, the subsequent buffer resize check (`sx > image->width`) can be bypassed because the wrapped value appears smaller than the current width. This results in a large attacker-influenced offset being used for a heap write at `image->data[pos]`. The vulnerability is reachable via any application using `sixel_decode_raw` or `sixel_decode`, including the `img2sixel` utility. A fix is available in version 1.8.7-r2.
Affected products
- saitoha libsixel 0.11.0 to 1.8.7-r1
Timeline
- 2026-05-03: advisory: GitHub Security Advisory published by maintainer
- 2026-05-14: disclosed: CVE published to NVD
- 2026-05-14: patched: Fixed in version 1.8.7-r2